10 ms·

Clubhouse user IDs, Chatroom IDs are transmitted in plaintext over the internet

179 points by amrrs 6y ago

unicornporn 6y ago
Who could've guessed? It would be interesting to see a "move slow and fix things" approach for once. But I guess it isn't compatible with ruthless expansion.
- sofixa 6y ago
  Clubhouse is a startup, what ruthless expansion? A lot of startups cut corners to get to market faster, but this is just inexcusable.
  - etaioinshrdlu 6y ago
    Haha, this is one of the tamest instances of cutting corners in the news lately. It's not like this is super-secret information either. It's not health, finance, or legal data. Some people on HN seem to take security much more seriously than necessary, as if security is the most important feature. But in business, it usually isn't.
    - nefitty 6y ago
      I, uh, sincerely hope you’re not in charge of any apps I use.
    - unicornporn 6y ago
      > Some people on HN seem to take security much more seriously than necessary Necessary to who?
polote 6y ago
This is not the bug of the year. Ok, the id is not the encrypted. So encrypt it and next. Nothing to see
- noop2714 6y ago
  > This is not the bug of the year. Ok, the id is not the encrypted. So encrypt it and next. Nothing to see The privacy implications of leaking user identifying information are massive. Not something that should be dismissed so quickly as “nothing to see”. Maybe not interesting for you, but many of us care about holding companies accountable for bad practices. If you don’t, this will become more common as it’s effectively being tolerated.
  - polote 6y ago
    There is no evidence that they tried to hide that. The company was created in 2020 and one of their API is not encrypted, that kind of things has probably happened to most of companies created less than a year ago
    - noop2714 6y ago
      > that kind of things has probably happened to most of companies created less than a year ago No company gets a free pass on the implications of sacrificing privacy or security. Even if “less than a year old”. This is serious: “Any observer of internet traffic could easily match IDs on shared chatrooms to see who is talking to whom. For mainland Chinese users, this is troubling”
      - YarickR2 6y ago
        Like somehow you're the judge the jury and the executioner of said conpanies. Don't use their product.
- hellotomyrars 6y ago
  Right. Do the obvious and right thing after you’re caught. No big deal. A dangerous and all too common pattern of negligence. Willful or otherwise.
arkadiyt 6y ago
Only peripherally related but after the recent Robinhood fiasco I downloaded the Interactive Brokers mobile app, and they send your login user/password in plaintext: https://twitter.com/arkadiyt/status/1356054340008460293 https://twitter.com/arkadiyt/status/1356054340008460293
- nickysielicki 6y ago
  This is pretty bizarre. I imagine it's due to user complaints about not being able to make trades while behind very strict corporate firewalls? Weird.
  - tialaramex 6y ago
    Their site claims it might be faster. Which totally made sense a decade or two ago, and they've been in this game for a very long time (the company itself pre-dates the Web substantially). Is it faster today? Probably not. And if you're trading from a phone app, the chances your execution happening 100ms later ruins your day is very tiny. Whereas if bad guys snoop your WiFi, MitM your login and use your capital to run the other side of a stupid scam (e.g. buying some penny stock with all your investment savings) that's really going to ruin your whole year. I can most easily imagine they had a proprietary setup in the 1990s, and one day they make a web site because of this exciting new technology. Should it have SSL? Security sounds good, but it is slower. Traders demand an option. Now, fast forward a few years you're building an iPhone app, your prototype looks good, but traders ask, where is that SSL option? Chances are the answer is "Um, TLS is always On? Because switching it Off would be stupid?". Oh dear, are you calling a long time customer "stupid" for not clicking the SSL box all these years? No of course you aren't, you add the SSL box to the app and everybody working on it learns not to point out that this is stupid.
    - dmurray 6y ago
      They do at least have almost-mandatory 2FA through SMS or Android app. So it's not quite as insecure as someone reading your email or snooping your WiFi getting the keys to the kingdom.
brobinson 6y ago
So the PRC now has a list of PRC nationals, based on their phone hardware IDs, who discussed "sensitive topics" (phrase used by PRC state media about Clubhouse) on the app? Yikes.
Kiro 6y ago
Maybe I'm stupid but how are user IDs and chatroom IDs sensitive information? How can I join a room or interact with a user if I don't know the ID? Just trying to understand the severity here and if I'm doing something wrong in my apps.
- josephg 6y ago
  User IDs are sensitive because they can be used by internet service providers to track and identify users as they move through various networks. And they can be associated to figure out who your contacts are. As others have mentioned, the CCP could use this information to punish users for joining rooms they don’t like. The rule is, if ever in doubt, send all data through https. There is just about no reason to use unencrypted http or tcp in 2021.
- saladgnu054 6y ago
  You can tell who is talking with whom.
  - propogandist 6y ago
    Snowden exposed mass 'metadata' collection, most didn't seem to care, sadly.
- CydeWeys 6y ago
  Why is your app sending anything over the network unencrypted? You're making HTTP requests (not HTTPS)??
  - np_tedious 6y ago
    I think it's UDP. Probably for the audio
    - CydeWeys 6y ago
      That may be true of Clubhouse but not necessarily for the person I responded to. Anyway, there's plenty of ways to encrypt UDP, such as DTLS; see this RFC: https://tools.ietf.org/html/rfc6347 https://tools.ietf.org/html/rfc6347
188201 6y ago
For me, Clubhouse is a honey pot for CCP to arrest people for expressing their opinion, otherwise why they are using a Shanghai-based startup for their voice backend platform? Not sure how many Xinjiang people and Chinese who are sympathetic to Xinjiang people are arrested after CCR blocked Clubhouse. Or prove me wrong, at least stop using Chinese SaaS service if they really care about their user. Or better, use an open source implementation to support their service.
- Barrin92 6y ago
  >why they are using a Shanghai-based startup for their voice backend platform because a lot of Chinese companies are really good at voice related services due to the ubiquitous use of it in China. (typing Mandarin is annoying because you have to use pinyin).
  - onlyfortoday2 6y ago
    yeah right lol
- vmception 6y ago
  > otherwise why they are using a Shanghai-based startup for their voice backend platform? Is there a term for this form of argument? Like where someone makes a rhetorical question after seeding the answer? Its like creating a false dilemma, where one intentionally removes non-binary choices for their own agenda, but its not quite a false dilemma yet, except after someone responds about how weak this form of argument is by presenting second, third and fourth reasons that were outside of the boundaries of the question but inside the boundaries of reality.
  - acheron9383 6y ago
    Seems like begging the question, they assume it is a CCP honeypot and then push the false dichotomy with the voice back end? *edit s/video/voice/
  - darkteflon 6y ago
    There is huge power in knowing the name of a thing, isn’t there. Reminds me of a Wittgenstein quote: "The limits of my language mean the limits of my world.”
offtop5 6y ago
Same reason Tinder ( Match Group who owns all the apps) sent user location data all over the place. Normal people will never learn about this , and doing it right would take too much effort. While I would love new better social media to take over, I don't think social media which serves it's users is possible. Hell, I self sensor more here than I do in real life. In real life if I say something odd it's forgotten within minutes.
- jdxcode 6y ago
  Too much effort to use TLS? EDIT: I didn’t realize initially this is UDP, but I think there is a similar solution like TLS for TCP
  - offtop5 6y ago
    And get the certs working ? Why bother , move fast and break things yo
    - jdxcode 6y ago
      Technically you don’t need verified certs to get the encryption
  - jcrawfordor 6y ago
    DTLS is the general "drop-in" TLS for UDP. It does have limitations and compromises, esp. in regards to real-time media, but this does seem like a situation where it would not be especially difficult to send this data over a DTLS-secured channel which is logically separate from the media.
  - dathinab 6y ago
    Even with UDP it's still not hard. Sure getting it right might be hard, but getting it somehow good enough to not be obviously bad is much less so. Not only are there thinks like DTLS, in the worst case you could just "ship" a AES key when you login over TCP/TLS and then you encrypt any udp message with that key or something like that. Sure there are many ways you can get it wrong but it's easy to setup and better then plaintext.
nikolay 6y ago
Why I can't register for an account even if the app is not available? Why, again, Android users get discriminated against and iPhone users get a leverage again and again?! How hard is to create a signup form and give everybody an equal chance to reserve their username?
- riffic 6y ago
  why do usernames need to be reserved? everyone on the service has a unique numerical identifier and email addresses are also unique. do the display name thing and use email as your auth identity. stop doing the same namespace mistake everyone else has made
  - nikolay 6y ago
    That's how many services lure people in with "Hurry up and reserve your username." It's like usernames matter anymore as URLs and domains lose their attractiveness, too. The worst mistake, though, is to piss people off and don't let them preserve their identity. For example, many startups use Twitter usernames, and it's pretty much one of the fairest options. If I was Clubhouse and when I launch a new service one day when I'm not so busy with my day job, I will have a sunrise period where GitHub user will reserve their username. There will be phase 2, when Twitter users will be able to grab theirs, too, and will get the option to use the "@" prefix if somebody with GitHub grabbed theirs or change it. Lastly, there will be Facebook and LinkedIn phases, too. How can one be pissed in such a scenario? Plus, I will be onboard the most influential people first.
    - riffic 6y ago
      yeah I figured it was a hype building tactic. I do like your ideas though, that's definitely a new one!
vmception 6y ago
I kind of like that Facebook is considering to compete with Clubhouse. There are a lot of software features that Clubhouse can add, but they have to or choose to focus on many other things instead. Something simple like a "shut up" button "we got your point two minutes ago". Competition will force them to re-prioritize just to keep the users.
ketamine__ 6y ago
What language are they using for the backend? Edit: It's off-topic. Chill out.
- nefitty 6y ago
  This is what I found from their job posting for a backend engineer, ”You have deep expertise in building, deploying, monitoring and scaling systems on AWS. You understand the ins and outs of Python, Postgres, Redis and more.” I also found out there’s a project management app called Clubhouse, so that’s a little weird. https://jobs.lever.co/joinclubhouse/939f5935-98cc-49af-8d6e-288fa48675d5 https://jobs.lever.co/joinclubhouse/939f5935-98cc-49af-8d6e-...
tosh 6y ago
In case you want to host your own Clubhouse or get a feeling for Clubhouse (or Twitter Spaces) without access to an iPhone and/or invite: "Jam" is an open source implementation of the "audio space" concept that I built over the last few days w/ @DoubleMalt and @mitschabaude There is still a lot to do but for now you can create rooms and moderate them (stage, audience, mic-flashing, …), powered by WebRTC and should work in any modern browser. Any feedback, suggestions, thoughts welcome, might do a Show HN in the next days https://jam.systems https://jam.systems
- offtop5 6y ago
  Very impressive, is just peer-to-peer communication or do you have some type of coordination server.
  - tosh 6y ago
    atm based on signalhub (https://github.com/mafintosh/signalhub https://github.com/mafintosh/signalhub) and there is also a TURN server https://gitlab.com/jam-systems/jam https://gitlab.com/jam-systems/jam to support rooms with larger audiences we'll probably need to add support for mixing on the server side as well eventually
    - tosh 6y ago
      Show HN: https://news.ycombinator.com/item?id=26131123 https://news.ycombinator.com/item?id=26131123
- mittermayr 6y ago
  Impressive that this literally only requires one click to get going, and seems to ask for no other requirements (and does browser + mobile equally well from what I can tell). Would be interesting to see how this behaves on large rooms (collections of people). Could also be useful as some sort of 'serverless' or quickly-deployable/click-and-run Clubhouse, perhaps even for certain countries that tend to shut these things down quickly.
  - 6y ago
gkoberger 6y ago
Hmm maybe I'm missing something, but why does this matter? For a long time, on Facebook, you didn't have a "username", you just had your "ID" in the URL. I'm just not sure how it could be exploited. I'd be more worried about it being hosted in China than user IDs being unencrypted.
- ketamine__ 6y ago
  As long as proper authorization for resources is in place I don't see the issue either.
- bdcravens 6y ago
  It's a metadata leak, not an authentication leak. A mapping of who is talking to who could be built up over time.
kashura 6y ago
It's amazing that cases like this still come up regardless of all the breaches. The level of carelessness blows my mind.

179 points by amrrs 6y ago

Who could've guessed? It would be interesting to see a "move slow and fix things" approach for once. But I guess it isn't compatible with ruthless expansion.

sofixa 6y ago
Clubhouse is a startup, what ruthless expansion? A lot of startups cut corners to get to market faster, but this is just inexcusable.
- etaioinshrdlu 6y ago
  Haha, this is one of the tamest instances of cutting corners in the news lately. It's not like this is super-secret information either. It's not health, finance, or legal data. Some people on HN seem to take security much more seriously than necessary, as if security is the most important feature. But in business, it usually isn't.
  - nefitty 6y ago
    I, uh, sincerely hope you’re not in charge of any apps I use.
  - unicornporn 6y ago
    > Some people on HN seem to take security much more seriously than necessary Necessary to who?

polote 6y ago

This is not the bug of the year. Ok, the id is not the encrypted. So encrypt it and next. Nothing to see

noop2714 6y ago
> This is not the bug of the year. Ok, the id is not the encrypted. So encrypt it and next. Nothing to see The privacy implications of leaking user identifying information are massive. Not something that should be dismissed so quickly as “nothing to see”. Maybe not interesting for you, but many of us care about holding companies accountable for bad practices. If you don’t, this will become more common as it’s effectively being tolerated.
- polote 6y ago
  There is no evidence that they tried to hide that. The company was created in 2020 and one of their API is not encrypted, that kind of things has probably happened to most of companies created less than a year ago
  - noop2714 6y ago
    > that kind of things has probably happened to most of companies created less than a year ago No company gets a free pass on the implications of sacrificing privacy or security. Even if “less than a year old”. This is serious: “Any observer of internet traffic could easily match IDs on shared chatrooms to see who is talking to whom. For mainland Chinese users, this is troubling”
    - YarickR2 6y ago
      Like somehow you're the judge the jury and the executioner of said conpanies. Don't use their product.
hellotomyrars 6y ago
Right. Do the obvious and right thing after you’re caught. No big deal. A dangerous and all too common pattern of negligence. Willful or otherwise.

arkadiyt 6y ago

Only peripherally related but after the recent Robinhood fiasco I downloaded the Interactive Brokers mobile app, and they send your login user/password in plaintext: https://twitter.com/arkadiyt/status/1356054340008460293 https://twitter.com/arkadiyt/status/1356054340008460293

nickysielicki 6y ago
This is pretty bizarre. I imagine it's due to user complaints about not being able to make trades while behind very strict corporate firewalls? Weird.
- tialaramex 6y ago
  Their site claims it might be faster. Which totally made sense a decade or two ago, and they've been in this game for a very long time (the company itself pre-dates the Web substantially). Is it faster today? Probably not. And if you're trading from a phone app, the chances your execution happening 100ms later ruins your day is very tiny. Whereas if bad guys snoop your WiFi, MitM your login and use your capital to run the other side of a stupid scam (e.g. buying some penny stock with all your investment savings) that's really going to ruin your whole year. I can most easily imagine they had a proprietary setup in the 1990s, and one day they make a web site because of this exciting new technology. Should it have SSL? Security sounds good, but it is slower. Traders demand an option. Now, fast forward a few years you're building an iPhone app, your prototype looks good, but traders ask, where is that SSL option? Chances are the answer is "Um, TLS is always On? Because switching it Off would be stupid?". Oh dear, are you calling a long time customer "stupid" for not clicking the SSL box all these years? No of course you aren't, you add the SSL box to the app and everybody working on it learns not to point out that this is stupid.
  - dmurray 6y ago
    They do at least have almost-mandatory 2FA through SMS or Android app. So it's not quite as insecure as someone reading your email or snooping your WiFi getting the keys to the kingdom.

brobinson 6y ago

So the PRC now has a list of PRC nationals, based on their phone hardware IDs, who discussed "sensitive topics" (phrase used by PRC state media about Clubhouse) on the app? Yikes.

Kiro 6y ago

Maybe I'm stupid but how are user IDs and chatroom IDs sensitive information? How can I join a room or interact with a user if I don't know the ID? Just trying to understand the severity here and if I'm doing something wrong in my apps.

josephg 6y ago
User IDs are sensitive because they can be used by internet service providers to track and identify users as they move through various networks. And they can be associated to figure out who your contacts are. As others have mentioned, the CCP could use this information to punish users for joining rooms they don’t like. The rule is, if ever in doubt, send all data through https. There is just about no reason to use unencrypted http or tcp in 2021.
saladgnu054 6y ago
You can tell who is talking with whom.
- propogandist 6y ago
  Snowden exposed mass 'metadata' collection, most didn't seem to care, sadly.
CydeWeys 6y ago
Why is your app sending anything over the network unencrypted? You're making HTTP requests (not HTTPS)??
- np_tedious 6y ago
  I think it's UDP. Probably for the audio
  - CydeWeys 6y ago
    That may be true of Clubhouse but not necessarily for the person I responded to. Anyway, there's plenty of ways to encrypt UDP, such as DTLS; see this RFC: https://tools.ietf.org/html/rfc6347 https://tools.ietf.org/html/rfc6347

188201 6y ago

For me, Clubhouse is a honey pot for CCP to arrest people for expressing their opinion, otherwise why they are using a Shanghai-based startup for their voice backend platform? Not sure how many Xinjiang people and Chinese who are sympathetic to Xinjiang people are arrested after CCR blocked Clubhouse. Or prove me wrong, at least stop using Chinese SaaS service if they really care about their user. Or better, use an open source implementation to support their service.

Barrin92 6y ago
>why they are using a Shanghai-based startup for their voice backend platform because a lot of Chinese companies are really good at voice related services due to the ubiquitous use of it in China. (typing Mandarin is annoying because you have to use pinyin).
- onlyfortoday2 6y ago
  yeah right lol
vmception 6y ago
> otherwise why they are using a Shanghai-based startup for their voice backend platform? Is there a term for this form of argument? Like where someone makes a rhetorical question after seeding the answer? Its like creating a false dilemma, where one intentionally removes non-binary choices for their own agenda, but its not quite a false dilemma yet, except after someone responds about how weak this form of argument is by presenting second, third and fourth reasons that were outside of the boundaries of the question but inside the boundaries of reality.
- acheron9383 6y ago
  Seems like begging the question, they assume it is a CCP honeypot and then push the false dichotomy with the voice back end? *edit s/video/voice/
- darkteflon 6y ago
  There is huge power in knowing the name of a thing, isn’t there. Reminds me of a Wittgenstein quote: "The limits of my language mean the limits of my world.”

offtop5 6y ago

Same reason Tinder ( Match Group who owns all the apps) sent user location data all over the place. Normal people will never learn about this , and doing it right would take too much effort. While I would love new better social media to take over, I don't think social media which serves it's users is possible. Hell, I self sensor more here than I do in real life. In real life if I say something odd it's forgotten within minutes.

jdxcode 6y ago
Too much effort to use TLS? EDIT: I didn’t realize initially this is UDP, but I think there is a similar solution like TLS for TCP
- offtop5 6y ago
  And get the certs working ? Why bother , move fast and break things yo
  - jdxcode 6y ago
    Technically you don’t need verified certs to get the encryption
- jcrawfordor 6y ago
  DTLS is the general "drop-in" TLS for UDP. It does have limitations and compromises, esp. in regards to real-time media, but this does seem like a situation where it would not be especially difficult to send this data over a DTLS-secured channel which is logically separate from the media.
- dathinab 6y ago
  Even with UDP it's still not hard. Sure getting it right might be hard, but getting it somehow good enough to not be obviously bad is much less so. Not only are there thinks like DTLS, in the worst case you could just "ship" a AES key when you login over TCP/TLS and then you encrypt any udp message with that key or something like that. Sure there are many ways you can get it wrong but it's easy to setup and better then plaintext.

nikolay 6y ago

Why I can't register for an account even if the app is not available? Why, again, Android users get discriminated against and iPhone users get a leverage again and again?! How hard is to create a signup form and give everybody an equal chance to reserve their username?

riffic 6y ago
why do usernames need to be reserved? everyone on the service has a unique numerical identifier and email addresses are also unique. do the display name thing and use email as your auth identity. stop doing the same namespace mistake everyone else has made
- nikolay 6y ago
  That's how many services lure people in with "Hurry up and reserve your username." It's like usernames matter anymore as URLs and domains lose their attractiveness, too. The worst mistake, though, is to piss people off and don't let them preserve their identity. For example, many startups use Twitter usernames, and it's pretty much one of the fairest options. If I was Clubhouse and when I launch a new service one day when I'm not so busy with my day job, I will have a sunrise period where GitHub user will reserve their username. There will be phase 2, when Twitter users will be able to grab theirs, too, and will get the option to use the "@" prefix if somebody with GitHub grabbed theirs or change it. Lastly, there will be Facebook and LinkedIn phases, too. How can one be pissed in such a scenario? Plus, I will be onboard the most influential people first.
  - riffic 6y ago
    yeah I figured it was a hype building tactic. I do like your ideas though, that's definitely a new one!

vmception 6y ago

I kind of like that Facebook is considering to compete with Clubhouse. There are a lot of software features that Clubhouse can add, but they have to or choose to focus on many other things instead. Something simple like a "shut up" button "we got your point two minutes ago". Competition will force them to re-prioritize just to keep the users.

ketamine__ 6y ago

What language are they using for the backend? Edit: It's off-topic. Chill out.

nefitty 6y ago
This is what I found from their job posting for a backend engineer, ”You have deep expertise in building, deploying, monitoring and scaling systems on AWS. You understand the ins and outs of Python, Postgres, Redis and more.” I also found out there’s a project management app called Clubhouse, so that’s a little weird. https://jobs.lever.co/joinclubhouse/939f5935-98cc-49af-8d6e-288fa48675d5 https://jobs.lever.co/joinclubhouse/939f5935-98cc-49af-8d6e-...

tosh 6y ago

In case you want to host your own Clubhouse or get a feeling for Clubhouse (or Twitter Spaces) without access to an iPhone and/or invite: "Jam" is an open source implementation of the "audio space" concept that I built over the last few days w/ @DoubleMalt and @mitschabaude There is still a lot to do but for now you can create rooms and moderate them (stage, audience, mic-flashing, …), powered by WebRTC and should work in any modern browser. Any feedback, suggestions, thoughts welcome, might do a Show HN in the next days https://jam.systems https://jam.systems

offtop5 6y ago
Very impressive, is just peer-to-peer communication or do you have some type of coordination server.
- tosh 6y ago
  atm based on signalhub (https://github.com/mafintosh/signalhub https://github.com/mafintosh/signalhub) and there is also a TURN server https://gitlab.com/jam-systems/jam https://gitlab.com/jam-systems/jam to support rooms with larger audiences we'll probably need to add support for mixing on the server side as well eventually
  - tosh 6y ago
    Show HN: https://news.ycombinator.com/item?id=26131123 https://news.ycombinator.com/item?id=26131123
mittermayr 6y ago
Impressive that this literally only requires one click to get going, and seems to ask for no other requirements (and does browser + mobile equally well from what I can tell). Would be interesting to see how this behaves on large rooms (collections of people). Could also be useful as some sort of 'serverless' or quickly-deployable/click-and-run Clubhouse, perhaps even for certain countries that tend to shut these things down quickly.
- 6y ago

gkoberger 6y ago

Hmm maybe I'm missing something, but why does this matter? For a long time, on Facebook, you didn't have a "username", you just had your "ID" in the URL. I'm just not sure how it could be exploited. I'd be more worried about it being hosted in China than user IDs being unencrypted.

ketamine__ 6y ago
As long as proper authorization for resources is in place I don't see the issue either.
bdcravens 6y ago
It's a metadata leak, not an authentication leak. A mapping of who is talking to who could be built up over time.

kashura 6y ago

It's amazing that cases like this still come up regardless of all the breaches. The level of carelessness blows my mind.